Allow everyone to use SFTP and restrict SSH port forwarding

[stephdl]

With the new policy we allow a group to OpenSSH, and we decide who is able to use either SSH and SFTP or only SFTP, It could be interesting to delegate a group matching everybody on the server. This will ease the authorization process if we want to delegate all users of the account provider.

From a security perspective, we could restrict also the TCP Forwarding for the sftp users, This is a hole in the security

Proposed solution

Disables all forwarding features, including X11, ssh-agent, TCP and Stream Local by adding the directive DisableForwarding

Match by the API the domain users@domain.com for AD or the locals@nethservertest.org for openldap and allow to use it inside the group dropdown

---

thank @DavidePrincipi

[nethbot]

in 7.7.1908/testing:

• nethserver-openssh-1.4.0-1.17.g496bfb1.ns7.noarch.rpm x86_64 armhfp aarch64

[nethbot]

in 7.7.1908/testing:

• nethserver-cockpit-1.4.4-1.8.g1cbe917.ns7.noarch.rpm x86_64 armhfp aarch64
• nethserver-cockpit-lib-1.4.4-1.8.g1cbe917.ns7.noarch.rpm x86_64 armhfp aarch64

[stephdl]

QA

Install nethserver-cockpit and nethserver-openssh from testing
install openldap or dc to have some groups/users
set to enabled $sssd{'ShellOverrideStatus'}

then you will see a new Everyone widget to delegate the access, to ssh and/or sftp.

You need to demonstrate that if Everyone is granted to ssh and/or sftp, a user can access even if its group is not listed, if Everyone is no access this user cannot connect anymore

[stephdl]

• remember translation

[DavidePrincipi]

VERIFIED

ok - ssh

ok - sftp-only, no port forwarding:

$ ssh -L 20980:localhost:980 second.user@192.168.122.5
second.user@192.168.122.5's password: 
This service allows sftp connections only.
Connection to 192.168.122.5 closed.
$ ssh -N -L 20980:localhost:980 second.user@192.168.122.5
second.user@192.168.122.5's password: 
channel 2: open failed: administratively prohibited: open failed

---

• Amended docinfo labels
• Pushed translations to Transifex

[nethbot]

in 7.7.1908/testing:

• nethserver-cockpit-1.4.4-1.9.g7faeffd.ns7.noarch.rpm x86_64 armhfp aarch64
• nethserver-cockpit-lib-1.4.4-1.9.g7faeffd.ns7.noarch.rpm x86_64 armhfp aarch64

[nethbot]

in 7.7.1908/updates:

• nethserver-openssh-1.4.1-1.ns7.noarch.rpm x86_64 armhfp aarch64

[nethbot]

in 7.7.1908/updates:

• nethserver-cockpit-1.4.5-1.ns7.noarch.rpm x86_64 armhfp aarch64
• nethserver-cockpit-lib-1.4.5-1.ns7.noarch.rpm x86_64 armhfp aarch64